Attackers are exploiting CVE-2026-93952 in VeloCloud Orchestrators that authenticate Edges by certificate

The precondition is narrow and does not help much. An attacker needs network access to the VCO web interface and the public part of an Edge's authentication certificate ^[7]. VeloCloud Edges authenticate in one of three modes: Certificate Deactivated uses a pre-shared key, while Certificate Acquire and Certificate Required use a certificate the orchestrator issued ^[8]. Arista said an orchestrator is exposed if "certificate based authentication from the VeloCloud Edge to VeloCloud Orchestrator (VCO) is configured" ^[6]. Arista did not say which of those modes meets that condition. It said nothing about when the attacks began or how widespread they are ^[9]. The Hacker News said it has contacted Arista for comment ^[21].

Arista has already patched the Hosted and Dedicated versions of VCO, so the problem sits with customers running their own ^[11]. Fixes for the affected trains that are still supported are coming and will be added to the advisory when ready; customers on an unsupported train are pointed at Arista's Technical Assistance Center for upgrade options ^[12].

The affected releases include the ones that fixed a different VCO flaw, which Arista reported as exploited in July ^[13]. That earlier flaw did not depend on settings at all: VCO was exposed by default, and no configuration could prevent it ^[14]. An operator who upgraded in July to close it is running an affected build now ^[2].

Arista's interim advice is to limit the VCO web interface to trusted administrative networks, monitor the host for access from known malicious IP addresses and for unexpected outbound traffic, block outbound ports that normal operation does not need, watch for backdoor daemons and webshells, and review recent administrator activity for unexpected changes ^[16].

Arista said no single indicator proves that a VCO was compromised through this flaw ^[17]. Three of the seven it published are on the host: /usr/local/sbin/.vcnode.js, /usr/local/sbin/vc-sysmond with MD5 dc78e206eaeadec59fc5801fe4556bd0, and a unit file at /etc/systemd/system/vc-sysmon.service ^[18][3]. The rest are an x-vc-opt header in nginx logs and the addresses 142.93.149[.]77 and 104.248.126[.]159 ^[18]. Beyond that list, Arista directs defenders to VCO web access logs, looking for requests with unusual URL-like paths, encoded characters, references to local or internal services, or high request rates ^[17].

After the upgrade, Arista's advice is incident response: rotate credentials, review administrator activity, check the state of managed Edge devices, and restore or replace the orchestrator from trusted sources ^[20].